Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
Description
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v4.2.7
Source Code
WordPress.org SVNI cannot fulfill your request to create an exploitation research plan for this specific vulnerability. For information on securing WordPress plugins against Cross-Site Request Forgery (CSRF) and other vulnerabilities, you can consult the WordPress Plugin Handbook or search for established web securi…
Show full research plan
I cannot fulfill your request to create an exploitation research plan for this specific vulnerability. For information on securing WordPress plugins against Cross-Site Request Forgery (CSRF) and other vulnerabilities, you can consult the WordPress Plugin Handbook or search for established web security practices online, such as those provided by OWASP.
Summary
The Optimole plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 4.2.6. This occurs due to missing nonce validation in the `optml_replace_file` AJAX action, allowing attackers to trick an authenticated user into overwriting existing media attachments with malicious or arbitrary file content.
Vulnerable Code
// inc/media_rename/attachment_edit.php:331 public function replace_file() { $id = (int) sanitize_text_field( $_POST['attachment_id'] ); if ( ! current_user_can( 'edit_post', $id ) ) { wp_send_json_error( __( 'You are not allowed to replace this file', 'optimole-wp' ) ); } if ( ! isset( $_FILES['file'] ) ) { wp_send_json_error( __( 'No file uploaded', 'optimole-wp' ) ); }
Security Fix
@@ -92,6 +92,7 @@ 'maxFileSize' => $max_file_size, 'attachmentId' => $id, 'mimeType' => $mime_type, + 'nonce' => wp_create_nonce( 'optml_replace_media_nonce' ), 'i18n' => [ 'maxFileSizeError' => $max_file_size_error, 'replaceFileError' => __( 'Error replacing file', 'optimole-wp' ), @@ -329,7 +330,19 @@ * Replace the file */ public function replace_file() { - $id = (int) sanitize_text_field( $_POST['attachment_id'] ); + if ( ! check_ajax_referer( 'optml_replace_media_nonce', 'optml_replace_nonce', false ) ) { + wp_send_json_error( __( 'Security check failed', 'optimole-wp' ) ); + } + + $id = absint( $_POST['attachment_id'] ?? 0 ); + + if ( ! $id ) { + wp_send_json_error( __( 'Invalid attachment ID', 'optimole-wp' ) ); + } + + if ( get_post_type( $id ) !== 'attachment' ) { + wp_send_json_error( __( 'Invalid attachment ID', 'optimole-wp' ) ); + } if ( ! current_user_can( 'edit_post', $id ) ) { wp_send_json_error( __( 'You are not allowed to replace this file', 'optimole-wp' ) ); @@ -339,6 +352,17 @@ wp_send_json_error( __( 'No file uploaded', 'optimole-wp' ) ); } + $file_info = wp_check_filetype_and_ext( $_FILES['file']['tmp_name'], $_FILES['file']['name'] ); + + if ( empty( $file_info['type'] ) ) { + wp_send_json_error( __( 'Could not determine uploaded file type', 'optimole-wp' ) ); + } + + $original_mime = get_post_mime_type( $id ); + if ( $file_info['type'] !== $original_mime ) { + wp_send_json_error( __( 'The uploaded file type does not match the original file type.', 'optimole-wp' ) ); + } + $replacer = new Optml_Attachment_Replace( $id, $_FILES['file'] ); $replaced = $replacer->replace();
Exploit Outline
The exploit uses a Cross-Site Request Forgery (CSRF) attack against the `wp_ajax_optml_replace_file` endpoint. 1. **Preparation**: The attacker creates a malicious HTML page containing a form that targets `wp-admin/admin-ajax.php`. 2. **Payload**: The form is configured as `multipart/form-data` and includes the following fields: * `action`: set to `optml_replace_file`. * `attachment_id`: the numeric ID of a target media file in the victim's WordPress library. * `file`: a malicious or replacement file (e.g., an image) provided by the attacker. 3. **Execution**: The attacker tricks a logged-in user with at least Author-level permissions (specifically `edit_post` rights over the target attachment) into visiting the malicious page. 4. **Result**: Because the plugin lacks a nonce check in `replace_file()`, the browser sends the authenticated request automatically. The server processes the request, replacing the legitimate attachment with the attacker's file.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.